-----box-----
#程式1擷取自WinObject.cs，針對部份輸入文字型的控制項，可使用WM_SETTEXT指定文字內容
//由類別名稱識別是否為特定的文字輸入控制項物件
public bool IsEditControl
{
	get 
	{
		string cn=ClassName.ToUpper();
		return (cn=="EDIT" || cn=="THUNDERRT5TEXTBOX" || cn=="RICHCNTL" || cn=="RICHEDIT");
	}
}

const uint WM_GETTEXTLENGTH=0x0e;
const uint WM_GETTEXT=0x0d;
const uint WM_SETTEXT=0x0c;

//視窗物件的標題或控制項的文字內容
public string Text
{

	get
	{
		if (IsEditControl) 
		{
			int l=(int) SendMessage(hWnd,WM_GETTEXTLENGTH,0,0);
			StringBuilder sb=new StringBuilder(l+1);
			l=(int) SendMessage(hWnd,WM_GETTEXT,sb.Capacity,sb);
			return sb.ToString();
		}
		else 
		{
			int length = GetWindowTextLength(hWnd);
			StringBuilder sb = new StringBuilder(length + 1);
			GetWindowText(hWnd, sb, sb.Capacity);
			return sb.ToString();				
		}
	}
	set
	{
		if (IsEditControl) 
			SendMessage(hWnd,WM_SETTEXT,0,value);
		else 
			SetWindowText(hWnd, value);
	}
}
-----end-----


-----box-----
#程式2 與下拉選單互動的範例
[DllImport("USER32.DLL", SetLastError=true)]
public static extern long SendMessage(IntPtr hWnd, uint msg, int wparam, StringBuilder sb);
private void button2_Click(object sender, System.EventArgs e)
{
//由Spy++觀察該下拉選單控制項的從屬關係，以FindChild方式鎖定之。
//由於同一層有多個TadvCityCbBox控制項，因此使用FindChildren再由陣列中取出第2個(戶籍地)。
//原理及細節說明請參見前期文章。
WinObject cb = (WinObject)
	WinObject.FindWindow("TBasicForm","財政部九十二年度綜合所得稅二維條碼結算申報系統")
	.FindChild("TNotebook","").FindChild("TPage","Basic").FindChild("TPanel","Panel2")
	.FindChild("TPanel","").FindChildren("TadvCityCbBox",null)[1];

int itemCount = (int) cb.SendMessage(0x0146,0,0); //CB_GETCOUNT=0x146
string[] itemValues=new string[itemCount];
Debug.Write("共有"+itemCount.ToString()+"個選項，包含有:");
int idxTaipei=-1;
for (int i=0; i<itemCount; i++) 
{
	//先取得字串長度 CB_GETLBTEXTLEN 0x0149
	int len=(int) cb.SendMessage(0x0149,(uint) i,0);
	//取回字串 CB_GETLBTEXT 0x0148
	StringBuilder sb=new StringBuilder(len);
	SendMessage(cb.Handle,0x0148, i, sb);
	itemValues[i]=sb.ToString();
	if (itemValues[i]=="台北市") idxTaipei=i;
	if (i % 10==0) Debug.WriteLine("");
	Debug.Write(itemValues[i]+" ");
}
Debug.WriteLine("");
//取得目前的選取索引值 CB_GETCURSEL 0x0147
int idxNow=(int) cb.SendMessage(0x0147,0,0);
Debug.WriteLine("目前的選取值="+idxNow.ToString()+"."+itemValues[idxNow]);
//改變選取索引值至台北市的選項，CB_SETCURSEL 0x014E
cb.SendMessage(0x014E,(uint) idxTaipei,0);
Debug.WriteLine("已設定為"+idxTaipei.ToString()+"."+itemValues[idxTaipei]);
}
-----end-----


-----box-----
#程式3 跨程序遠端記憶體操作 RemoteMemory.cs
public class RemoteMemory
{
	private uint lpMem=0;
	private int size=0;
	private IntPtr hProcess;
	[DllImport("kernel32.dll")]
	public static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, uint dwProcessId);

	uint PROCESS_VM_OPERATION  = (0x0008);  
	uint PROCESS_VM_READ       = (0x0010);  
	uint PROCESS_VM_WRITE      = (0x0020);
	uint MEM_COMMIT           = 0x1000;
	uint MEM_RESERVE          = 0x2000;
	uint MEM_RELEASE          = 0x8000;
	uint PAGE_READWRITE       = 0x04;

	[DllImport("kernel32.dll")]
	public static extern uint VirtualAllocEx(IntPtr hProcess, uint lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
	[DllImport("kernel32.dll")]
	public static extern int WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpObject, uint nSize, ref uint lpNumberOfBytesWritten);
	[DllImport("kernel32.dll")]
	public static extern int ReadProcessMemory(IntPtr hProccess, uint lpBaseAddress, uint lpObject, uint nSize, ref uint lpNumberOfBytesRead);
	[DllImport("kernel32.dll")]
	public static extern int ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress,[In, Out] byte[] buffer, uint nSize, ref uint lpNumberOfBytesRead);
	[DllImport("kernel32.dll")]
	public static extern int VirtualFreeEx(IntPtr hProcess, uint lpAddress, int dwSize, uint dwFreeType);
	[DllImport("USER32.DLL", SetLastError=true)]
	public static extern uint SendMessage(IntPtr hWnd, uint Msg, uint wParam, uint lParam);
	[DllImport("user32.dll")]
	static extern uint GetWindowThreadProcessId(IntPtr hWnd, ref uint processId);
	//在指定的Process中,取得一段指定大小的記憶體
	public RemoteMemory(IntPtr hWnd, int size)
	{
		uint dwProcessId=0;
		GetWindowThreadProcessId(hWnd,ref dwProcessId);
		hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, 0, dwProcessId);
		lpMem=VirtualAllocEx(hProcess, 0, (uint) size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
		this.size=size;
	}
	//釋放原先取得的記憶體
	public void Unallocate() 
	{
		VirtualFreeEx(hProcess, lpMem, 0, MEM_RELEASE);
	}
	//將物件的內容抄寫到先前取得的記憶體中
	public void Write(object o) 
	{
		if (Marshal.SizeOf(o)>size) 
			throw new ApplicationException("RemoteMemory.Write method error: allocated memory size is not enough!");
		GCHandle gc=GCHandle.Alloc(o,GCHandleType.Pinned);
		uint bytesWritten=0;
		int ret=WriteProcessMemory(hProcess, lpMem, (uint) gc.AddrOfPinnedObject(), (uint) Marshal.SizeOf(o), ref bytesWritten);
	}
	//將記憶體中的內容還原至物件
	public void Read(ref object o)  
	{
		GCHandle gc=GCHandle.Alloc(o,GCHandleType.Pinned);
		uint bytesRead=0;
		int ret=ReadProcessMemory(hProcess, lpMem, (uint) gc.AddrOfPinnedObject(), (uint) Marshal.SizeOf(o), ref bytesRead);
	}
	//將記憶體中的某一段解析成為字串
	public string ReadCString(uint offset, int stringLen) 
	{
		uint bytesRead=0;
		byte[] buffer=new byte[stringLen];
		int ret=ReadProcessMemory(hProcess, lpMem+offset, buffer, (uint) stringLen, ref bytesRead);
		return szToString(buffer);
	}
	//將整塊記憶體解析成為字串
	public string ReadCString() 
	{
		return ReadCString(0,size);		
	}
	//將位元組轉成字串
	private string szToString(byte[] byteArray) 
	{
		int length=0;
		for (int i=0; i<byteArray.Length; i++) 
		{
			if (byteArray[i]==0) 
			{
				length=i;
				break;
			}
		}
		return System.Text.Encoding.GetEncoding("big5").GetString(byteArray,0,length);
	}
	//傳回記憶體位址
	public uint MemoryAddress 
	{
		get { return lpMem; }
	}
}-----end-----

-----box-----
#程式4 將List View的Grid內容，轉為DataTable: ListViewSpy.cs

public class ListViewSpy
{
	[StructLayout(LayoutKind.Sequential)]
		public struct LVITEM //List View的Item資料結構
	{
		public uint mask;
		public int iItem;
		public int iSubItem;
		public uint state;
		public uint stateMask;
		public IntPtr pszText; //struct中不可使用StringBuilder
		public int cchTextMax;
		public int iImage;
		public IntPtr lParam;
	}

	[StructLayout(LayoutKind.Sequential)]
		public struct HDITEM //List View的Header資料結構
	{
		public uint mask; 
		public int cxy; 
		public IntPtr pszText; 
		public uint hbm; 
		public int cchTextMax; 
		public int fmt; 
		public IntPtr lParam;
	}

	[DllImport("USER32.DLL", SetLastError=true)]
	public static extern uint SendMessage(IntPtr hWnd, uint msg, uint wparam, uint lparam);

	private IntPtr hWnd;
	private int columnCount,rowCount;
	private const int MAX_STR_SIZE=256;
	private DataTable table=new DataTable();

	public ListViewSpy(IntPtr hWnd)
	{
		this.hWnd=hWnd;
		//取得Header(SysHeader32)
		uint LVM_GETHEADER=0x1000+31;
		IntPtr header=new IntPtr(SendMessage(hWnd,LVM_GETHEADER,0,0));
		if (header==IntPtr.Zero) return;
		//取得Column數
		uint HDM_GETITEMCOUNT=0x1200+0;
		columnCount=(int) SendMessage(header,HDM_GETITEMCOUNT,0,0);
		//取得Column Header Text
		HDITEM hdi=new HDITEM();
		uint HDI_TEXT=0x0002;
		hdi.mask=HDI_TEXT;
		hdi.cchTextMax=MAX_STR_SIZE;
		int iStructSize=Marshal.SizeOf(hdi);
		//在目的地Process取得一塊用來存放HDITEM的記憶體空間
		//並額外多要一些用來放字串
		RemoteMemory rm=new RemoteMemory(hWnd,iStructSize+MAX_STR_SIZE);
		//指向額外的空間
		hdi.pszText=new IntPtr(rm.MemoryAddress+iStructSize);
		//將hdi的內容複製到目的地Process的記憶體上
		rm.Write(hdi);

		//SendMessage
		uint HDM_GETITEMA=0x1200+3;
		byte[] buffer=new byte[MAX_STR_SIZE];
		table=new DataTable();
		for (int i=0; i<columnCount; i++) 
		{
			int r=(int) SendMessage(header,HDM_GETITEMA, (uint) i,rm.MemoryAddress);
			//以欄位名稱建立DataTable的欄位
			table.Columns.Add(rm.ReadCString((uint) iStructSize,MAX_STR_SIZE),Type.GetType("System.String"));
		}
		rm.Unallocate();

		//取得ListView資料筆數
		uint LVM_GETITEMCOUNT=0x1000+4;
		rowCount=(int) SendMessage(hWnd,LVM_GETITEMCOUNT,0,0);
		LVITEM lvi=new LVITEM();
		uint LVIF_TEXT = 0x0001;
		lvi.mask=LVIF_TEXT;
		lvi.cchTextMax=MAX_STR_SIZE;
		//在目的地Process建立LVITEM，原理同HDITEM
		iStructSize=Marshal.SizeOf(lvi);
		rm=new RemoteMemory(hWnd,(int) iStructSize+MAX_STR_SIZE);
		lvi.pszText=new IntPtr(rm.MemoryAddress+iStructSize);

		//SendMessage
		uint LVM_GETITEMTEXTA=0x1000+45;
		for (int i=0; i<rowCount; i++) 
		{
			lvi.iItem=i;
			DataRow row=table.NewRow();
			for (int j=0; j<columnCount; j++) 
			{
				lvi.iSubItem=j;
				rm.Write(lvi);
				int ret=(int) SendMessage(hWnd,LVM_GETITEMTEXTA, (uint) i,rm.MemoryAddress);
				row[j]=rm.ReadCString((uint) iStructSize,MAX_STR_SIZE);
			}
			table.Rows.Add(row);
		}
		rm.Unallocate();
	}

	public DataTable Data 
	{
		get {	return table;}
	}
}
-----end-----

-----box-----
程式5 將Task Manager Processes List View的資料在DataGrid還原, 結果如圖3
private void button1_Click(object sender, System.EventArgs e)
{
	//使用SPY++時，看到Task Manager的Class Name是#32770 (Dialog)
	//尋找時記得只要指定#32770即可，加上(Dialog)後會找不到
	WinObject lvProcesses=WinObject.FindWindow("#32770","Windows Task Manager")
		.FindChild("#32770","").FindChild("SysListView32","Processes");
	ListViewSpy lvs=new ListViewSpy(lvProcesses.Handle);
	dataGrid1.DataSource=lvs.Data;
	dataGrid1.Refresh();				
}